DbgDisasmAt - Other Method

[Downpour]

Hello,

I'm currently working on a plugin for x32dbg and I was wondering if there is another way to disassemble a function where I can receive information like the opcode as char so I don't have to work with the char array to see what kind of instruction I'm dealing with. And I also want to know if there is a way to see if the argument from the DISASM_INSTR array is a register, pointer, memory value/constant or such also without dealing with the char array.

Regards,

Castor

[fearless]

DbgDisasmFastAt uses a BASIC_INSTRUCTION_INFO structure:

BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo); 

and you can then access the returned BASIC_INSTRUCTION_INFO structure to read information such as type, branch etc:

typedef struct
{
    duint value; //displacement / addrvalue (rip-relative)
    MEMORY_SIZE size; //byte/word/dword/qword
    char mnemonic[MAX_MNEMONIC_SIZE];
} MEMORY_INFO;

typedef struct
{
    duint value;
    VALUE_SIZE size;
} VALUE_INFO;

//definitions for BASIC_INSTRUCTION_INFO.type
#define TYPE_VALUE 1
#define TYPE_MEMORY 2
#define TYPE_ADDR 4

typedef struct
{
    DWORD type; //value|memory|addr
    VALUE_INFO value; //immediat
    MEMORY_INFO memory;
    duint addr; //addrvalue (jumps + calls)
    bool branch; //jumps/calls
    bool call; //instruction is a call
    int size;
    char instruction[MAX_MNEMONIC_SIZE * 4];
} BASIC_INSTRUCTION_INFO;

The xAnalyzer plugin makes use of this: https://github.com/ThunderCls/xAnalyzer/blob/master/xAnalyzer/xanalyzer.cpp#L329

Hope that helps.

 

 

[Downpour]

Thanks for your response!

But I was looking for a more "abstract" way instead of dealing with strings. But I wrote a small parser which handles the diassembled instruction which works fine for now.

[mrexodia]

You don't really have to deal with strings.

Use DISASM_ARG.type to see if it's memory or a number/register. Then you can use DISASM_ARG.const to get the imm value or DISASM_ARG.value to get the register value. If isdigit(DISASM_ARG.mnemonic) is true you know that it's a constant. However probably you are looking for capstone, it has exact details on the instruction data. This function is only used by the GUI to provide context-sensitive operations.

[Downpour]

I think my main problem was/is to handle instructions like this:

mov eax,dword ptr ds:[ebx]		; 1)
mov eax,dword ptr ds:[486486]		; 2)
mov eax,dword ptr ds:[ecx+EA]		; 3)
mov eax,dword ptr ds:[ebx+ecx*4]	; 4)
mov eax,dword ptr ds:[ecx*4+486486]	; 5)
mov eax,dword ptr ds:[ebx+ecx]		; 6)

1) and 2) are easy to solve, but I was struggeling with the rest because my goal was to cut that argument down into pieces so I can change for example in 5) the scale *4, in 4) ecx into another register or in 3) the EA into another value. My ugly solution is to use regular expressions.

[mrexodia]

In that case you need to use capstone.

[Downpour]

Thank you I'm using your Capstone wrapper now and it works!

Edited May 22, 2017 by Castor